# CVEs published 2006-09-25

15 CVEs were published on September 25, 2006: 0 critical, 0 high. Days are UTC.

- [CVE-2006-4967](https://cve.now/CVE-2006-4967.md): Multiple cross-site scripting (XSS) vulnerabilities in NextAge Cart allow remote attackers to inject arbitrary web script or HTML via (1) th (no CVSS)
- [CVE-2006-4968](https://cve.now/CVE-2006-4968.md): PHP remote file inclusion vulnerability in includes/functions\_admin.php in PNphpBB 1.2g allows remote attackers to execute arbitrary PHP cod (no CVSS)
- [CVE-2006-4969](https://cve.now/CVE-2006-4969.md): Multiple PHP remote file inclusion vulnerabilities in WAHM E-Commerce Pie Cart Pro allow remote attackers to execute arbitrary PHP code via (no CVSS)
- [CVE-2006-4970](https://cve.now/CVE-2006-4970.md): PHP remote file inclusion vulnerability in enc/content.php in WAHM E-Commerce Pie Cart Pro allows remote attackers to execute arbitrary PHP (no CVSS)
- [CVE-2006-4971](https://cve.now/CVE-2006-4971.md): MyBB (aka MyBulletinBoard) allows remote attackers to obtain sensitive information via a direct request for inc/plugins/hello.php, which rev (no CVSS)
- [CVE-2006-4972](https://cve.now/CVE-2006-4972.md): Cross-site scripting (XSS) vulnerability in archive/index.php/forum-4.html in MyBB (aka MyBulletinBoard) allows remote attackers to inject a (no CVSS)
- [CVE-2006-4973](https://cve.now/CVE-2006-4973.md): Cross-site scripting (XSS) vulnerability in Default.aspx in Perpetual Motion Interactive Systems DotNetNuke before 3.3.5, and 4.x before 4.3 (no CVSS)
- [CVE-2006-4974](https://cve.now/CVE-2006-4974.md): Buffer overflow in Ipswitch WS\_FTP Limited Edition (LE) 5.08 allows remote FTP servers to execute arbitrary code via a long response to a PA (no CVSS)
- [CVE-2006-4975](https://cve.now/CVE-2006-4975.md): Yahoo! Messenger for WAP permits saving messages that contain JavaScript, which allows user-assisted remote attackers to inject arbitrary we (no CVSS)
- [CVE-2006-4976](https://cve.now/CVE-2006-4976.md): The Date Library in John Lim ADOdb Library for PHP allows remote attackers to obtain sensitive information via a direct request for (1) serv (no CVSS)
- [CVE-2006-4977](https://cve.now/CVE-2006-4977.md): Multiple unrestricted file upload vulnerabilities in (1) back/upload\_img.php and (2) admin/upload\_img.php in Walter Beschmout PhpQuiz 1.2 an (no CVSS)
- [CVE-2006-4978](https://cve.now/CVE-2006-4978.md): Multiple SQL injection vulnerabilities in Walter Beschmout PhpQuiz 1.2 and earlier allow remote attackers to execute arbitrary SQL commands (no CVSS)
- [CVE-2006-4979](https://cve.now/CVE-2006-4979.md): Direct static code injection vulnerability in cfgphpquiz/install.php in Walter Beschmout PhpQuiz 1.2 and earlier allows remote attackers to (no CVSS)
- [CVE-2006-4965](https://cve.now/CVE-2006-4965.md): Apple QuickTime 7.1.3 Player and Plug-In allows remote attackers to execute arbitrary JavaScript code and possibly conduct other attacks via (no CVSS)
- [CVE-2006-4966](https://cve.now/CVE-2006-4966.md): PHP remote file inclusion vulnerability in inc/ifunctions.php in chumpsoft phpQuestionnaire (phpQ) 3.12 allows remote attackers to execute a (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2006-09-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.